我需要在我的AWS组织中部署AWS GuardDuty,覆盖所有账户和区域。
我的第一步是将GuardDuty的管理委托给一个指定的帐户。由于GuardDuty是区域资源,我需要在所有区域执行这样的委派。请注意,我们在几乎所有的AWS区域运营。
以下是完成此任务的暴力方法:
这个方法可行,但有几个缺点:
理想情况下,我想利用
我尝试了@Matt Schuchard建议的方法:
给定这个资源:
Terraform 1.0.10会产生以下错误:
以下是完成此任务的暴力方法:
provider "aws" {
region = "us-east-1"
alias = "us-east-1"
}
provider "aws" {
region = "us-east-2"
alias = "us-east-2"
}
# Do the same for the remaining regions
resource "aws_guardduty_organization_admin_account" "us-east-1" {
provider = aws.us-east-1
admin_account_id = "123456789..."
}
resource "aws_guardduty_organization_admin_account" "us-east-2" {
provider = aws.us-east-2
admin_account_id = "123456789..."
}
# Do the same for the remaining regions
这个方法可行,但有几个缺点:
- 大量重复
- 我需要记住在添加新区域时更新此代码
理想情况下,我想利用
data "aws_regions" "all" {}
来循环现有区域并动态创建委托资源和提供程序。我尝试了@Matt Schuchard建议的方法:
给定这个资源:
resource "aws_guardduty_organization_admin_account" "us-east-1" {
# interpolate in for expression here since not allowed in provider argument
for_each = toset([for region in data.aws_regions.this.names : "aws.${region}"])
provider = each.value
admin_account_id = "123456789..."
}
Terraform 1.0.10会产生以下错误:
Error: Failed to query available provider packages
Could not retrieve the list of available versions for provider hashicorp/each: ...